{"record":{"id":"94f7158014b7aab1","repo":"nats-io/nats-server","slug":"error-parsing-x509-certificate-key-pair-v","errorCode":null,"errorMessage":"error parsing X509 certificate/key pair: %v","messagePattern":"error parsing X509 certificate/key pair: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":5842,"sourceCode":"\tconfig := tls.Config{\n\t\tMinVersion:         tls.VersionTLS12,\n\t\tCipherSuites:       tc.Ciphers,\n\t\tCurvePreferences:   tc.CurvePreferences,\n\t\tInsecureSkipVerify: tc.Insecure,\n\t}\n\n\tswitch {\n\tcase tc.CertFile != _EMPTY_ && tc.CertStore != certstore.STOREEMPTY:\n\t\treturn nil, certstore.ErrConflictCertFileAndStore\n\tcase tc.CertFile != _EMPTY_ && tc.KeyFile == _EMPTY_:\n\t\treturn nil, fmt.Errorf(\"missing 'key_file' in TLS configuration\")\n\tcase tc.CertFile == _EMPTY_ && tc.KeyFile != _EMPTY_:\n\t\treturn nil, fmt.Errorf(\"missing 'cert_file' in TLS configuration\")\n\tcase tc.CertFile != _EMPTY_ && tc.KeyFile != _EMPTY_:\n\t\t// Now load in cert and private key\n\t\tcert, err := tls.LoadX509KeyPair(tc.CertFile, tc.KeyFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing X509 certificate/key pair: %v\", err)\n\t\t}\n\t\tcert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing certificate: %v\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{cert}\n\tcase tc.CertStore != certstore.STOREEMPTY:\n\t\terr := certstore.TLSConfig(tc.CertStore, tc.CertMatchBy, tc.CertMatch, tc.CaCertsMatch, tc.CertMatchSkipInvalid, &config)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\tcase tc.Certificates != nil:\n\t\t// Multiple certificate support.\n\t\tconfig.Certificates = make([]tls.Certificate, len(tc.Certificates))\n\t\tfor i, certPair := range tc.Certificates {\n\t\t\tcert, err := tls.LoadX509KeyPair(certPair.CertFile, certPair.KeyFile)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing X509 certificate/key pair %d/%d: %v\", i+1, len(tc.Certificates), err)","sourceCodeStart":5824,"sourceCodeEnd":5860,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L5824-L5860","documentation":"tls.LoadX509KeyPair failed while loading the configured cert_file/key_file, and the server wraps the underlying error with this message. The files may be unreadable, malformed PEM, or mismatched cert/key.","triggerScenarios":"parseTLS calling tls.LoadX509KeyPair(tc.CertFile, tc.KeyFile) which returns a non-nil error (bad permissions, invalid PEM blocks, encrypted keys, mismatched pair).","commonSituations":"Wrong file permissions; concatenating cert and key into wrong files; key encrypted with a passphrase; files truncated by failed deployments.","solutions":["Verify both files exist, are valid PEM, and readable by the server user (the wrapped %v names the underlying cause)","Check that cert and key form a matching pair (compare public key / modulus)","Decrypt or remove passphrase from the key file","Re-export the certificate chain including intermediates"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if _, err := tls.LoadX509KeyPair(cfg.TLS.CertFile, cfg.TLS.KeyFile); err != nil {\n  return fmt.Errorf(\"pre-flight keypair check failed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := tls.LoadX509KeyPair(cert, key); err != nil {\n  return fmt.Errorf(\"invalid cert/key pair %s/%s: %w\", cert, key, err)\n}","preventionTips":["Pre-flight load key pairs at deploy time","Check file permissions for the server's run user","Ensure key is unencrypted and matches the certificate","Include full chain (leaf + intermediates) in cert_file"],"tags":["tls","x509","certificate"],"backgroundTag":"tls-keypair-load-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}